Pre-download DCGM/fabricmanager debs on host to bypass chroot apt

The NVIDIA CUDA HTTPS apt source (developer.download.nvidia.com) may be
unreachable from inside the live-build container chroot, causing
'E: Unable to locate package datacenter-gpu-manager-4-cuda13'.

Add build-dcgm.sh that downloads DCGM and nvidia-fabricmanager .deb
packages on the build host (verifying SHA256 against Packages.gz) and
caches them in BEE_CACHE_DIR.  build.sh (step 25-dcgm, nvidia only)
copies them into LB_DIR/config/packages.chroot/ before lb build, so
live-build creates a local apt repo from them.  The chroot installs the
packages from the local repo without ever contacting the NVIDIA CUDA
HTTPS source.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

iso/builder/build.sh

@@ -1296,6 +1296,18 @@ if [ -f "${LB_INCLUDES}/root/.ssh/authorized_keys" ]; then
     chmod 600 "${LB_INCLUDES}/root/.ssh/authorized_keys"
 fi
 
+# --- pre-download NVIDIA apt packages into config/packages.chroot ---
+# live-build creates a local apt repo from config/packages.chroot/*.deb so the
+# chroot can install them without reaching the NVIDIA CUDA HTTPS source.
+if [ "$BEE_GPU_VENDOR" = "nvidia" ]; then
+    run_step "download DCGM ${DCGM_VERSION} / fabricmanager ${NVIDIA_FABRICMANAGER_VERSION} packages" \
+        "25-dcgm" \
+        sh "${BUILDER_DIR}/build-dcgm.sh" \
+        "${DCGM_VERSION}" \
+        "${NVIDIA_FABRICMANAGER_VERSION}" \
+        "${LB_DIR}"
+fi
+
 # --- build ISO using live-build ---
 echo ""
 echo "=== building ISO (variant: ${BUILD_VARIANT}) ==="